testo/convention

Dangerous workflowscaution

The repository contains one pull_request_target workflow, which can execute privileged workflow logic in response to pull requests. No untrusted checkout or script injection was detected, limiting the concern but not eliminating the privileged-workflow risk.

Maintainerscaution

Only one registry publishing account is listed, which is a limited direct publishing base. The organization-backed repository provides some compensation, so this is a caution rather than a severe risk.

Release historycaution

Five releases in the last 128 days, with a median interval of about 30 days and a release as recently as the assessment date, indicate ongoing publishing activity. The short history still limits evidence of long-term maturity.

Repo issue activitycaution

There were no new or merged pull requests in the last month, and issue counts are unavailable. This provides little evidence of community activity but is partly consistent with the repository being a synchronized read-only mirror.

Repo popularitycaution

The repository has zero stars, forks, and watchers. This is weak supporting evidence, but popularity alone does not establish poor health for a young, specialized plugin.